README

Manage your Content Security Policy whitelist from the Magento admin panel instead of editing and deploying csp_whitelist.xml by hand. Add allowed hosts per policy (script-src, style-src, font-src, …) in Stores → Configuration → Cti → CSP Whitelist, save, flush cache — done.

This is a maintained fork of ctidigital/magento2-csp-whitelist, verified to install and run on Magento 2.4.9 / PHP 8.4.

Why this fork exists

Magento 2.4 ships Content Security Policy in report-only mode and expects you to whitelist every third-party host (analytics, payment iframes, chat widgets, CDNs) in an XML file that lives in your theme/module and needs a deploy to change. This module moves that whitelist into the admin panel, so marketing and ops can add a blocked host without a developer and a release.

The upstream module had no release since 2021 and its composer.json declared no require section at all — Composer would install it on any Magento/PHP version without warning, so a shop could pull it onto an incompatible release and only find out in production. This fork declares proper constraints and is tested end-to-end on Magento 2.4.9.

What changed vs upstream

Added require: php 8.1–8.5 and magento/framework >=103.0.4 <104 (Magento 2.4.6–2.4.9), so Composer refuses incompatible installs instead of failing silently later.
Verified on Magento 2.4.9 / PHP 8.4: setup:upgrade, module:enable and storefront rendering with the plugin active, no errors.

Install

composer require sisl-source/magento2-csp-whitelist
bin/magento module:enable CtiDigital_CspWhitelist
bin/magento setup:upgrade

Usage

When the browser console shows something like:

Refused to load https://www.google-analytics.com/analytics.js because it does not appear
in the script-src directive of the Content Security Policy.

Note the host (www.google-analytics.com) and the violated policy (script-src).
Go to Stores → Configuration → Cti → CSP Whitelist, enable the module.
Add a row: pick the policy, enter the host. Save, flush cache.

License

MIT — see LICENSE.

Maintained by SISL — Magento 2 / Adobe Commerce studio. One of a set of revived, free, open-source Magento modules kept working on the latest Magento releases.

Maintained by SISL

Maintained fork by SISL — Magento 2 development and modules. More self-hosted plugins: SISL Marketplace.

sisl-source / magento2-csp-whitelist

Package info

Security

Statistics